@outerlayer/cli 0.26.2 → 0.26.3

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # @outerlayer/cli
 
+## 0.26.3
+
+### Patch Changes
+
+- bdf88b4: MicroVM builds boot a Linux 6.18 guest kernel, the newer of the two guest kernels Firecracker 1.17 supports.
+- bdfdf7b: A machine with OuterLayer's hooks in both managed settings and user settings records each hook event once. Claude Code starts both copies of the hook; the second one does nothing, so the session's warnings appear once and Work is called once.
+
 ## 0.26.2
 
 ### Patch Changes

package/dist/{build-AW4A2QPK.js → build-EBQYXL7Y.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { buildRepositoryImage } from './chunk-DJILFADE.js';
+export { buildRepositoryImage } from './chunk-7LVF4E5V.js';
 import './chunk-PYSKSROG.js';
 import './chunk-JBJTC3UU.js';
-export { RecipeError } from './chunk-FI66JNLT.js';
+export { RecipeError } from './chunk-TSW4DGV2.js';
 import './chunk-L4CW6LZQ.js';
 import './chunk-2K3TCQHW.js';
 import './chunk-JGD5TWQ2.js';

package/dist/build-info.json

@@ -1 +1 @@
-{"id":"2026-10-16T18:16:32.915Z+7b81ff6","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}
+{"id":"2026-10-16T19:10:06.995Z+98c3824","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}

package/dist/{builder-TDCBQ2RD.js → builder-WEGLC2F2.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-KZLLLARE.js';
-import './chunk-FI66JNLT.js';
+export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-ZLEXMZFW.js';
+import './chunk-TSW4DGV2.js';
 import './chunk-7RQ73DLO.js';
 import './chunk-QE3UQAHK.js';
 import './chunk-QZBXLLTV.js';

package/dist/{check-KL3LDAI3.js → check-WJJ325EQ.js}

@@ -1,41 +1,41 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { probeCredentials } from './chunk-6OYAW5SF.js';
-import './chunk-OL2O5PEI.js';
+import { probeCredentials } from './chunk-XF77SNB4.js';
+import './chunk-SKZG7SAN.js';
 import './chunk-TKL74NLB.js';
 import './chunk-ZVB57WI6.js';
 import './chunk-6FAP657M.js';
 import './chunk-3JVYMD4G.js';
 import './chunk-YETTWTAY.js';
 import './chunk-TPKYTORP.js';
-import './chunk-V5LUWRCV.js';
+import './chunk-XDHYZWEK.js';
 import './chunk-MWPBF2XG.js';
 import './chunk-UNF7MWEL.js';
-import './chunk-U2FSJBNI.js';
+import './chunk-2AKDF6C2.js';
 import './chunk-EORWWFPA.js';
 import './chunk-ESVW4MJY.js';
-import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-TODY3MTS.js';
+import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-ZPXI7LMG.js';
 import './chunk-4IFKLYMM.js';
 import './chunk-YYYRBYWG.js';
 import './chunk-TBT347UY.js';
-import './chunk-PCY7IGSL.js';
-import './chunk-RO3BRAO6.js';
-import './chunk-GUT4IU7K.js';
+import './chunk-W7LGHNXT.js';
+import './chunk-364XDGOK.js';
+import './chunk-VHVFU6QU.js';
 import './chunk-665QWBNW.js';
 import './chunk-TQMI335S.js';
 import './chunk-5PMQDQFV.js';
 import './chunk-MLD2NA7N.js';
 import { parseRunnerEnv } from './chunk-6MZSX4M7.js';
-import './chunk-DJILFADE.js';
+import './chunk-7LVF4E5V.js';
 import './chunk-PYSKSROG.js';
 import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
-import './chunk-KZLLLARE.js';
-import './chunk-FI66JNLT.js';
+import './chunk-ZLEXMZFW.js';
+import './chunk-TSW4DGV2.js';
 import './chunk-MXTN35XN.js';
 import './chunk-XLC7KEUV.js';
-import './chunk-DXHISLCI.js';
-import './chunk-GMPXOQTH.js';
+import './chunk-J7BXZLSO.js';
+import './chunk-UKCNOAO6.js';
 import './chunk-HXFRJKMU.js';
 import './chunk-TEVO3RUV.js';
 import './chunk-BUP5N3X6.js';
@@ -47,7 +47,7 @@ import './chunk-7RQ73DLO.js';
 import './chunk-W3NVHOCS.js';
 import './chunk-MQ743JX3.js';
 import './chunk-QRZLUUNN.js';
-import './chunk-2EAVBJMO.js';
+import './chunk-FO7F6QSV.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-2O5KA67H.js';
 import './chunk-BKO6JEZI.js';

package/dist/{chunk-U2FSJBNI.js → chunk-2AKDF6C2.js}

@@ -5,7 +5,7 @@ import { LaunchFilter } from './chunk-ESVW4MJY.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
 import { migrateLegacyArtifactSidecars, planArtifactUpload, artifactsStatePath, sanitizeTerminal, acquireArtifactSpoolLock, artifactBlobsDir, resolveArtifactTurnIndex, isArtifactTombstoned, ARTIFACT_RETRY_MAX_AGE_MS, writeArtifactSpoolState, reclaimUnneededArtifactBlobs, neededArtifactShas } from './chunk-BUP5N3X6.js';
 import { cliFetch, resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-QRZLUUNN.js';
-import { writeSyncStatus, spoolDir } from './chunk-2EAVBJMO.js';
+import { writeSyncStatus, spoolDir } from './chunk-FO7F6QSV.js';
 import { readLatestProvenanceForSession, readContextProvenance } from './chunk-ZJSNLVCE.js';
 import { hookExecSpoolPath } from './chunk-2O5KA67H.js';
 import { applyReportedCost } from './chunk-BKO6JEZI.js';

package/dist/{chunk-RO3BRAO6.js → chunk-364XDGOK.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { MIN_ENGINE_MAJOR } from './chunk-GUT4IU7K.js';
+import { MIN_ENGINE_MAJOR } from './chunk-VHVFU6QU.js';
 import { runnerImageVersion } from './chunk-665QWBNW.js';
-import { firecrackerArch, MICROVM_ARCHES, guestAssetsPinned } from './chunk-FI66JNLT.js';
+import { firecrackerArch, MICROVM_ARCHES, guestAssetsPinned } from './chunk-TSW4DGV2.js';
 import { spawnSync } from 'child_process';
 import { existsSync, accessSync, constants, statSync, readFileSync } from 'fs';
 

package/dist/{chunk-DJILFADE.js → chunk-7LVF4E5V.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { claimPidFile, RunnerAlreadyRunningError, releasePidFile } from './chunk-PYSKSROG.js';
 import { startTimeOf } from './chunk-JBJTC3UU.js';
-import { CLAUDE_CODE_VERSION, NODE_IMAGE, DEFAULT_BASE_IMAGE, RecipeError, locateRecipe, readRecipe, assertBuildable, TINI_VERSION, GH_VERSION, writeSanitizedRecipe, classifyProperties, GH_SHA256, TINI_SHA256, SANITIZED_NAME } from './chunk-FI66JNLT.js';
+import { CLAUDE_CODE_VERSION, NODE_IMAGE, DEFAULT_BASE_IMAGE, RecipeError, locateRecipe, readRecipe, assertBuildable, TINI_VERSION, GH_VERSION, writeSanitizedRecipe, classifyProperties, GH_SHA256, TINI_SHA256, SANITIZED_NAME } from './chunk-TSW4DGV2.js';
 import { RUNNER_DIR_MODE, repoCacheDir, imagesDir, attemptStamp, runnerDir, rootfsPathFor, RUNNER_FILE_MODE } from './chunk-L4CW6LZQ.js';
 import { withGitConfig, tokenHeader, PROXY_WARNING_FLAG } from './chunk-2K3TCQHW.js';
 import { RELAY_ID, RELAY_USER } from './chunk-JGD5TWQ2.js';

package/dist/{chunk-2EAVBJMO.js → chunk-FO7F6QSV.js}

@@ -6,7 +6,7 @@ import { readRepoConnection, findGitDirs } from './chunk-BJ3KTMDH.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { deadHooksState, huskyPrepareScript, preparePackageManagerCommand } from './chunk-TUSYOL2O.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import { readFileSync, mkdirSync, writeFileSync, renameSync, existsSync, statSync, appendFileSync, opendirSync, unlinkSync } from 'fs';
+import { readFileSync, mkdirSync, writeFileSync, renameSync, existsSync, readdirSync, unlinkSync, statSync, appendFileSync, opendirSync } from 'fs';
 import { spawn, execFileSync } from 'child_process';
 import { createHash } from 'crypto';
 import { join, dirname, resolve } from 'path';
@@ -308,6 +308,42 @@ function refreshCommand(workspaceDistDir, trusted) {
 function spoolDir(home = homeFromEnv()) {
   return join(home, ".outerlayer", "spool");
 }
+var DUPLICATE_RUN_WINDOW_MS = 2e3;
+var DUPLICATE_RUN_CLAIM_TTL_MS = 6e4;
+function isDuplicateRun(dir, event, input, now = Date.now(), claim = claimRun) {
+  try {
+    const claims = join(dir, "hook-runs");
+    mkdirSync(claims, { recursive: true });
+    const key = createHash("sha256").update(`${event}
+${input}`).digest("hex");
+    const bucket = Math.floor(now / DUPLICATE_RUN_WINDOW_MS);
+    try {
+      claim(join(claims, `${key}-${bucket}`), now);
+    } catch (err) {
+      return err.code === "EEXIST";
+    }
+    if (claimedWithinWindow(join(claims, `${key}-${bucket - 1}`), now)) return true;
+    for (const name of readdirSync(claims)) {
+      const claimed = Number(name.slice(name.lastIndexOf("-") + 1)) * DUPLICATE_RUN_WINDOW_MS;
+      if (!(now - claimed <= DUPLICATE_RUN_CLAIM_TTL_MS)) unlinkSync(join(claims, name));
+    }
+    return false;
+  } catch {
+    return false;
+  }
+}
+function claimRun(path, now) {
+  writeFileSync(path, String(now), { flag: "wx" });
+}
+function claimedWithinWindow(path, now) {
+  let text;
+  try {
+    text = readFileSync(path, "utf8");
+  } catch {
+    return false;
+  }
+  return text === "" || now - Number(text) < DUPLICATE_RUN_WINDOW_MS;
+}
 function hookFiredMarkerPath(event, home = homeFromEnv()) {
   const safe = event.replace(/[^A-Za-z0-9_-]/g, "").slice(0, 64) || "unknown";
   return join(spoolDir(home), `last-fired-${safe}`);
@@ -679,6 +715,7 @@ async function runHookFast(event, home = homeFromEnv(), read = readStdin, env =
     }
     const dir = spoolDir(home);
     mkdirSync(dir, { recursive: true });
+    if (isDuplicateRun(dir, resolvedEvent, stdin)) return;
     const record = {
       t: (/* @__PURE__ */ new Date()).toISOString(),
       event: resolvedEvent,
@@ -773,4 +810,4 @@ function recordLinkExitFailure(argv, home = homeFromEnv(), target = process) {
   });
 }
 
-export { AUTO_SYNC_DEBOUNCE_MS, SYNC_STALE_AFTER_MS, WORK_LEASE_RENEW_DEBOUNCE_MS, WORK_LINK_RETRIES, assessSyncHealth, checkInstalledCliStaleness, contextPossiblyGoverned, formatAgo, handleWorkLaunch, handleWorkSessionEnd, hookFiredMarkerPath, installedCliDistDir, logHookError, markWorkLeaseRenewed, maybeAutoSync, maybeRenewWorkLease, readSyncStatus, recordLinkExitFailure, refreshCommand, runHookFast, sanitizeForContext, spoolDir, workspaceRootOf, writeSyncStatus };
+export { AUTO_SYNC_DEBOUNCE_MS, DUPLICATE_RUN_WINDOW_MS, SYNC_STALE_AFTER_MS, WORK_LEASE_RENEW_DEBOUNCE_MS, WORK_LINK_RETRIES, assessSyncHealth, checkInstalledCliStaleness, contextPossiblyGoverned, formatAgo, handleWorkLaunch, handleWorkSessionEnd, hookFiredMarkerPath, installedCliDistDir, isDuplicateRun, logHookError, markWorkLeaseRenewed, maybeAutoSync, maybeRenewWorkLease, readSyncStatus, recordLinkExitFailure, refreshCommand, runHookFast, sanitizeForContext, spoolDir, workspaceRootOf, writeSyncStatus };

package/dist/{chunk-DXHISLCI.js → chunk-J7BXZLSO.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { WorkCommandError, postJson } from './chunk-GMPXOQTH.js';
+import { WorkCommandError, postJson } from './chunk-UKCNOAO6.js';
 import { defaultGitRunner, materializeContext, isStagingWriteFault, lookupGoverningSource } from './chunk-W3NVHOCS.js';
 import { signingFetchFor } from './chunk-QRZLUUNN.js';
 import { unsupportedLayout, layoutRefusalReason, composeDelivery } from './chunk-VPEGE3QZ.js';

package/dist/{chunk-WA7R6U2F.js → chunk-K7FCZCLQ.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { checkStarterFiles, contextIsGoverned, checkBuildSkill } from './chunk-XFGL53GU.js';
-import { resolveCredentials, getJson, WorkCommandError } from './chunk-GMPXOQTH.js';
+import { resolveCredentials, getJson, WorkCommandError } from './chunk-UKCNOAO6.js';
 import { isLinkedRepository } from './chunk-TEVO3RUV.js';
 import { sanitizeTerminal } from './chunk-BUP5N3X6.js';
 import { checkFormerSkillNames } from './chunk-MQ743JX3.js';
 import { resolveGatewayCredentials, defaultFetch } from './chunk-QRZLUUNN.js';
-import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-2EAVBJMO.js';
+import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-FO7F6QSV.js';
 import { readStatuslineState, STATE_FRESH_MS } from './chunk-I7RZHMXW.js';
 import { hookCommandEscapesControlPlane, CONTROL_PLANE_DIR_VARIABLE } from './chunk-HCVLP7XA.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
@@ -1186,7 +1186,7 @@ async function gatherDoctorChecks() {
     const { runnerVmCheck } = await import('./doctor-53F2PYY7.js');
     checks.push(runnerVmCheck(configPath, { lima: realLima(), home: homeFromEnv(), instance: runnerVm.instance }));
   } else if (hasRunnerBlock(configPath)) {
-    const { runnerHostChecks } = await import('./doctor-3LCCPBX6.js');
+    const { runnerHostChecks } = await import('./doctor-NV2PUERZ.js');
     const hooks = (() => {
       try {
         return loadRunnerConfig(configPath).hooks;

package/dist/{chunk-OL2O5PEI.js → chunk-SKZG7SAN.js}

@@ -1,19 +1,19 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { readsJobState, READ_JOB_STATE_FORMATS, jobStateFormatOf } from './chunk-ZVB57WI6.js';
-import { senderPidfile } from './chunk-V5LUWRCV.js';
+import { senderPidfile } from './chunk-XDHYZWEK.js';
 import { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD } from './chunk-MWPBF2XG.js';
 import { writeDockerClientConfig } from './chunk-UNF7MWEL.js';
-import { installScrubContext } from './chunk-U2FSJBNI.js';
-import { ADDED_USER, AssetError, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, resolveAgentUser, AgentUserError, runBuildSteps, shellQuote, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, containerSenderCommand, signalInContainer, syncInContainer, copyTranscriptsFromContainer, senderAliveScript, helperFirecrackerNote, HelperRefusal, GH_CONFIG_YML, ghHostsYml, isLiteralAddress, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, copyJudgeTree } from './chunk-GUT4IU7K.js';
-import { readBranchHead, fetchCommit, diffBetween } from './chunk-DJILFADE.js';
+import { installScrubContext } from './chunk-2AKDF6C2.js';
+import { ADDED_USER, AssetError, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, resolveAgentUser, AgentUserError, runBuildSteps, shellQuote, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, containerSenderCommand, signalInContainer, syncInContainer, copyTranscriptsFromContainer, senderAliveScript, helperFirecrackerNote, HelperRefusal, GH_CONFIG_YML, ghHostsYml, isLiteralAddress, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, copyJudgeTree } from './chunk-VHVFU6QU.js';
+import { readBranchHead, fetchCommit, diffBetween } from './chunk-7LVF4E5V.js';
 import { isSameProcess, startTimeOf } from './chunk-JBJTC3UU.js';
-import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, COMMAND_DIR, childEnvironment, judgeCommand, JUDGE_MAX_TURNS, MAX_REPORT_BYTES, JUDGE_DIR } from './chunk-KZLLLARE.js';
-import { CLAUDE_CODE_VERSION, FIRECRACKER_VERSION } from './chunk-FI66JNLT.js';
+import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, COMMAND_DIR, childEnvironment, judgeCommand, JUDGE_MAX_TURNS, MAX_REPORT_BYTES, JUDGE_DIR } from './chunk-ZLEXMZFW.js';
+import { CLAUDE_CODE_VERSION, FIRECRACKER_VERSION } from './chunk-TSW4DGV2.js';
 import { waitForAgent, vmExecArgs } from './chunk-MXTN35XN.js';
 import { socketPathProblem, vsockLinks, LEASE_LINK, linkVsockSockets } from './chunk-XLC7KEUV.js';
-import { describeCallFailure, resolveGoverningSource, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, formatDuration, retrySend, formatClock } from './chunk-DXHISLCI.js';
-import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-GMPXOQTH.js';
+import { describeCallFailure, resolveGoverningSource, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, formatDuration, retrySend, formatClock } from './chunk-J7BXZLSO.js';
+import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-UKCNOAO6.js';
 import { planArtifactUpload } from './chunk-BUP5N3X6.js';
 import { isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-JWRX5ZTT.js';
 import { parseSize } from './chunk-7RQ73DLO.js';

package/dist/{chunk-FI66JNLT.js → chunk-TSW4DGV2.js}

@@ -249,10 +249,10 @@ var FIRECRACKER_SHA256 = {
 var FIRECRACKER_BINARY_SHA256 = {
   x86_64: "99ad0f5cd0514a88aad0e9ae8cfdb3cc3b4ab9d190e1194602406c786b5de7a5"
 };
-var GUEST_ASSETS_VERSION = "6";
+var GUEST_ASSETS_VERSION = "7";
 var GUEST_ASSETS_BASE_URL = `https://github.com/outerlayerai/guest-assets/releases/download/guest-${GUEST_ASSETS_VERSION}`;
 var GUEST_KERNEL_SHA256 = {
-  x86_64: "5a2d716d301615c69fefc2f9574954e838269f14d5e8b0d1bad88b680cd372ee"
+  x86_64: "8552fad4bdea1d49f3e7d2aa500ce3f8918fcd2fc66779fd83235949688a39bb"
 };
 var GUEST_HELPER_SHA256 = {
   x86_64: "0ae934d3ad3f2a94abffcc3f044ba633b1a523dc17ff0c2bc322ed7d7fc505ea"

package/dist/{chunk-GMPXOQTH.js → chunk-UKCNOAO6.js}

@@ -428,7 +428,7 @@ async function runWorkLinkSession(opts) {
     return await linkSession(opts);
   } catch (err) {
     if (opts.logFailures) {
-      const { logHookError } = await import('./hook-fast-LZSHEKUA.js');
+      const { logHookError } = await import('./hook-fast-SDFXJEAW.js');
       const reason = err instanceof Error ? err.message : String(err);
       logHookError(opts.home ?? homeFromEnv(opts.env ?? process.env), new Error(`work link-session #${opts.number} failed: ${reason}`));
     }

package/dist/{chunk-GUT4IU7K.js → chunk-VHVFU6QU.js}

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { runnerImageVersion } from './chunk-665QWBNW.js';
-import { readDefaultBranchHead, cloneRepository, buildRepositoryImage } from './chunk-DJILFADE.js';
+import { readDefaultBranchHead, cloneRepository, buildRepositoryImage } from './chunk-7LVF4E5V.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
 import { currentCliBuild } from './chunk-OGFGZQA3.js';
-import { createDockerHost, builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, childEnvironment, JUDGE_DIR, JUDGE_REPORT, MAX_REPORT_BYTES, spawnRun } from './chunk-KZLLLARE.js';
-import { FIRECRACKER_VERSION, hostHelperPinned, firecrackerArch, MICROVM_ARCHES, RecipeError, DOCKER_FEATURE, CLAUDE_CODE_VERSION, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, JAILER_BINARY_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, GUEST_ASSETS_VERSION, DEFAULT_BASE_IMAGE } from './chunk-FI66JNLT.js';
+import { createDockerHost, builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, childEnvironment, JUDGE_DIR, JUDGE_REPORT, MAX_REPORT_BYTES, spawnRun } from './chunk-ZLEXMZFW.js';
+import { FIRECRACKER_VERSION, hostHelperPinned, firecrackerArch, MICROVM_ARCHES, RecipeError, DOCKER_FEATURE, CLAUDE_CODE_VERSION, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, JAILER_BINARY_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, GUEST_ASSETS_VERSION, DEFAULT_BASE_IMAGE } from './chunk-TSW4DGV2.js';
 import { execCapture } from './chunk-MXTN35XN.js';
 import { GUEST_CID } from './chunk-XLC7KEUV.js';
-import { describeCallFailure, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript } from './chunk-DXHISLCI.js';
-import { WorkCommandError } from './chunk-GMPXOQTH.js';
+import { describeCallFailure, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript } from './chunk-J7BXZLSO.js';
+import { WorkCommandError } from './chunk-UKCNOAO6.js';
 import { hostAllowed } from './chunk-UXYLWVTQ.js';
 import { parseDuKilobytes } from './chunk-7RQ73DLO.js';
 import { sharedSkillNames, skillConflictMessage } from './chunk-VPEGE3QZ.js';

package/dist/{chunk-PCY7IGSL.js → chunk-W7LGHNXT.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-RO3BRAO6.js';
-import { MIN_ENGINE_MAJOR } from './chunk-GUT4IU7K.js';
+import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-364XDGOK.js';
+import { MIN_ENGINE_MAJOR } from './chunk-VHVFU6QU.js';
 import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-5PMQDQFV.js';
 import { runnerCredentialProblem } from './chunk-JWRX5ZTT.js';
 import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-L4CW6LZQ.js';

package/dist/{chunk-V5LUWRCV.js → chunk-XDHYZWEK.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { LiveUploader } from './chunk-U2FSJBNI.js';
-import { spoolDir } from './chunk-2EAVBJMO.js';
+import { LiveUploader } from './chunk-2AKDF6C2.js';
+import { spoolDir } from './chunk-FO7F6QSV.js';
 import { CaptureDaemon } from './chunk-QE3UQAHK.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';

package/dist/{chunk-6OYAW5SF.js → chunk-XF77SNB4.js}

@@ -1,25 +1,25 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, commandLogOffset, execCommandLine, startSender, startHostServices, finishJob, isContainerTracked, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, AttemptLogBook, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, ALREADY_RELEASED, inTeardown } from './chunk-OL2O5PEI.js';
+import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, commandLogOffset, execCommandLine, startSender, startHostServices, finishJob, isContainerTracked, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, AttemptLogBook, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, ALREADY_RELEASED, inTeardown } from './chunk-SKZG7SAN.js';
 import { writePendingUpdate } from './chunk-TKL74NLB.js';
 import { JOB_STATE_FORMAT, readsJobState, jobStateFormatOf } from './chunk-ZVB57WI6.js';
 import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-6FAP657M.js';
 import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
 import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-YETTWTAY.js';
 import { RUNNER_PROTOCOL } from './chunk-TPKYTORP.js';
-import { currentSkillCommand, formerSkillProblem, placeholderQueues, placeholderProblem } from './chunk-TODY3MTS.js';
+import { currentSkillCommand, formerSkillProblem, placeholderQueues, placeholderProblem } from './chunk-ZPXI7LMG.js';
 import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, isInLayout, cleanVersions, stagingDir } from './chunk-4IFKLYMM.js';
 import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { leaseTimeLeftMs, LEASE_SECONDS, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandExec, measureDisk, setUpRunnerCgroup, createContainerRuntime, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied } from './chunk-GUT4IU7K.js';
+import { leaseTimeLeftMs, LEASE_SECONDS, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandExec, measureDisk, setUpRunnerCgroup, createContainerRuntime, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied } from './chunk-VHVFU6QU.js';
 import { tagToPull, pullInstruction, imageTag, writeUpdateStatus } from './chunk-665QWBNW.js';
 import { isVersion, compareVersions, satisfiesRange } from './chunk-TQMI335S.js';
 import { checkFit } from './chunk-MLD2NA7N.js';
 import { claimPidFile, readPidFile, releasePidFile } from './chunk-PYSKSROG.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
-import { writeJobFile, ensureRunnerIdentity, readJobFile, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, BUILD_LABEL, RUNNER_LABEL, readJobFileChecked } from './chunk-KZLLLARE.js';
-import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-DXHISLCI.js';
-import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-GMPXOQTH.js';
+import { writeJobFile, ensureRunnerIdentity, readJobFile, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, BUILD_LABEL, RUNNER_LABEL, readJobFileChecked } from './chunk-ZLEXMZFW.js';
+import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-J7BXZLSO.js';
+import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-UKCNOAO6.js';
 import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-JWRX5ZTT.js';
 import { exceedsDisk } from './chunk-7RQ73DLO.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
@@ -1749,7 +1749,7 @@ var CLAIM_REFUSAL_CODES = new Set(
   "pull_request_from_fork pull_request_on_default_branch pull_request_ambiguous pull_request_repository_not_connected repository_not_reachable branch_claimed_elsewhere".split(" ")
 );
 async function tryClaimAndStart(state, item, queue) {
-  const { postJson: postJson2 } = await import('./work-cmd-SJB6N6FZ.js');
+  const { postJson: postJson2 } = await import('./work-cmd-UQ45HDM4.js');
   const log = logOf(state);
   const hostKey = await loadHostKey(state.config.configPath);
   const claim = await retrySend(
@@ -2735,7 +2735,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
     const outcome = await onStartUnderMarker({
       configPath,
       own: ownVersionOf(deps),
-      check: update.check ? () => update.check(configPath) : async () => (await import('./check-KL3LDAI3.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
+      check: update.check ? () => update.check(configPath) : async () => (await import('./check-WJJ325EQ.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log
     });

package/dist/{chunk-KZLLLARE.js → chunk-ZLEXMZFW.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RecipeError, BUILDKIT_IMAGE } from './chunk-FI66JNLT.js';
+import { RecipeError, BUILDKIT_IMAGE } from './chunk-TSW4DGV2.js';
 import { parseSize } from './chunk-7RQ73DLO.js';
 import { compareVersions } from './chunk-QE3UQAHK.js';
 import { ensureHostKey } from './chunk-F6DIHHBS.js';

package/dist/{chunk-TODY3MTS.js → chunk-ZPXI7LMG.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { isPlaceholderCommand } from './chunk-PCY7IGSL.js';
-import { describeCallFailure } from './chunk-DXHISLCI.js';
-import { WorkCommandError, getJson } from './chunk-GMPXOQTH.js';
+import { isPlaceholderCommand } from './chunk-W7LGHNXT.js';
+import { describeCallFailure } from './chunk-J7BXZLSO.js';
+import { WorkCommandError, getJson } from './chunk-UKCNOAO6.js';
 import { sanitizeTerminal } from './chunk-BUP5N3X6.js';
 import { builtinKind } from './chunk-JWRX5ZTT.js';
 import { signerFor } from './chunk-F6DIHHBS.js';